Privacy Policy
This page explains what personal data nähen collects when you visit the site or place an order, why, how long we keep it, who we pass it to, and how to exercise your rights. It is written in application of Regulation (EU) 2016/679 and the French Data Protection Act of 6 January 1978 as amended.
Who is responsible for your data
The data controller is nähen SARL, Le Martinet, 48160 Saint-Michel-de-Dèze, France, registered under number 889 976 668.
For any question about your data, write to us at bonjour@nahen.fr. Given its size and the nature of its activity, nähen is not required to appoint a data protection officer.
What we collect
We collect only what we need, and nothing we ask of you without reason.
- When you order: surname, first name, delivery and billing address, email address, telephone number if you give one, details of the items, the personalisation entered, the amount and the date. Your card details never reach us: they are entered and processed directly by our payment provider.
- When you create an account: the same data, plus a password stored in encrypted form that we cannot read, your order history, your saved addresses, your wishlist and your loyalty points balance.
- When you sign up to the newsletter: your email address, and your first name if you give it.
- When you write to us: by email, through the contact form or by chat, the content of your message and your contact details.
- When you leave a review: your display name, your rating and your comment.
- When you browse: IP address, browser type, pages viewed, date and time. This connection data is generated automatically by the server.
Why, and on what basis
| Processing | Legal basis | Retention |
|---|---|---|
| Processing and delivering your orders, issuing invoices, handling returns | Performance of the contract | 10 years from the order (accounting obligation) |
| Managing your customer account, your addresses and your loyalty points | Performance of the contract | Until the account is deleted, or 3 years with no order or login |
| Sending you our news and offers | Your consent | Until you withdraw consent, or 3 years without interaction |
| Answering your messages and providing customer service | Legitimate interest in replying to you | 3 years from the last exchange |
| Publishing product reviews | Your consent | Until you ask for removal |
| Preventing payment fraud and securing the site | Legitimate interest in protecting our business | 1 year for connection logs |
| Measuring site traffic and assessing our advertising campaigns | Your consent | 13 months at most for the cookies concerned |
Once these periods expire, the data is deleted or anonymised. Data needed to prove a right may be archived separately, with restricted access, until the applicable limitation period expires.
Who receives your data
We neither sell nor rent your data. It is passed only to the providers strictly necessary to run the shop, who act on our instructions and are bound to confidentiality:
- Our host, which stores the site and its database: PHPnet France, 97-97 bis rue Général Mangin, 38100 Grenoble, France. Servers located in France.
- Our payment provider, which receives and processes your card details without our having access to them: [to be completed: name of the provider and link to its privacy policy].
- La Poste, which receives your name and delivery address together with your email or telephone number so it can notify you of delivery.
- Our email provider, for messages relating to your orders and, where applicable, the newsletter: [to be completed: name of the provider].
- Meta Platforms Ireland Ltd., if and only if you have accepted advertising cookies, to measure how our Facebook and Instagram campaigns perform.
Your data may also be disclosed to administrative or judicial authorities where the law requires it.
Transfers outside the European Union
Our data is hosted in France. Some of our providers — notably those for traffic measurement and advertising — belong to groups established in the United States and may transfer some data there. Such transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the provider's certification under the EU–US Data Privacy Framework. You may ask us for a copy of the safeguards in place.
Cookies
A cookie is a small file placed on your device when you visit the site. We use two kinds.
The ones the site cannot work without
These do not require your agreement, because without them the site stops working. They serve no advertising purpose.
| Cookie | Purpose | Lifetime |
|---|---|---|
| laravel_session | Keeps your session open during your visit | 2 hours |
| XSRF-TOKEN | Protects forms against fraudulent submissions | 2 hours |
| cart | Keeps the contents of your basket between visits | 30 days |
| currency | Remembers the currency you chose | 1 year |
| show_cookie_bar, show_newsletter_popup | Avoid showing you again a banner you have already dismissed | 1 year |
| meta_consent | Records your answer on advertising cookies | 1 year |
The ones that wait for your agreement
Traffic measurement and advertising cookies are placed only after you accept them in the banner shown when you arrive. These are the Meta cookies (_fbp and _fbc), which link a visit to a Facebook or Instagram campaign and measure its result.
Refusing these cookies in no way hinders your browsing or your order. You can change your mind at any time by deleting the site's cookies from your browser settings, which will bring the banner back. Your choice is kept for thirteen months at most.
Your rights
You have the following rights over data concerning you:
- Access: confirmation that we process your data, and a copy of it.
- Rectification: correction of inaccurate or incomplete data. Your contact details can be changed directly from your customer account.
- Erasure: deletion of your data, subject to our retention obligations — an invoice cannot be erased before ten years have passed.
- Restriction: freezing a processing operation while a check is carried out.
- Objection: objecting to processing based on our legitimate interest, and at any time to direct marketing.
- Portability: receiving, in a machine-readable format, the data you supplied to us.
- Withdrawal of consent: at any time, without calling into question what was done beforehand.
- Post-mortem directives: setting out what should happen to your data after your death.
To exercise them, write to us at bonjour@nahen.fr or by post to nähen SARL, Le Martinet, 48160 Saint-Michel-de-Dèze, France. We reply within one month, extended to three months where the request is complex, in which case we tell you. We may ask for proof of identity where there is reasonable doubt.
Every newsletter email carries an immediate unsubscribe link.
Complaints to the supervisory authority
If, after contacting us, you consider that your rights are not being respected, you may complain to the French data protection authority: Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr. If you live in another Member State, you may also complain to your own national authority.
Security
Exchanges with the site are encrypted over HTTPS. Passwords are stored as non-reversible hashes. Access to order data is restricted to the workshop staff who need it, through named accounts. Our backups are encrypted and kept in France.
As no system is infallible, we encourage you to choose a password of your own and not to reuse it elsewhere. In the event of a data breach likely to result in a high risk to your rights, we would inform you as soon as possible.
Changes
This policy may change as our services or the regulations evolve. Any substantial change will be flagged on the site and, where it concerns processing based on your consent, we will ask you for it again.